The MSI Radix AXE6600 router firmware version v781521 contains an OS command injection vulnerability in the accesscontrol function. This flaw allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges on the affected device. The vulnerability is due to improper neutralization of special elements used in OS commands, enabling command injection. The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary commands on the router with root privileges, potentially leading to full system compromise. This can result in unauthorized control over the device, data exposure, disruption of network services, and further attacks on connected networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the device's management interfaces and monitor for suspicious activity targeting the accesscontrol function.